Buffer overflow in fig2dev - CVE-2020-21683

Vulnerability identifier: #VU112001

CSH Severity: Medium

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-21683

CWE-ID: CWE-120

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the shade_or_tint_name_after_declare_color() function in fig2dev/dev/genpstricks.c when converting a xfig file into pstricks format. A remote attacker can pass a specially crafted file to the application and crash it.

fig2dev
SUSE Linux Enterprise Workstation Extension
Ubuntu
fig2dev (Ubuntu package)
transfig
transfig-debuginfo
transfig-debugsource

Install updates from vendor's website.

fig2dev - update to 3.2.8
fig2dev (Ubuntu package) - addressed in versions 1:3.2.6a-6ubuntu1.1+esm1, 1:3.2.7a-7ubuntu0.1+esm1, 1:3.2.8b-1ubuntu0.1~esm1, 1:3.2.9-3ubuntu0.1~esm1, 1:3.2.9-4ubuntu0.1
transfig - update to 3.2.8b-4.15.1
transfig-debuginfo - update to 3.2.8b-4.15.1
transfig-debugsource - update to 3.2.8b-4.15.1

• https://sourceforge.net/p/mcj/tickets/77/
• https://sourceforge.net/u/hamarituc/fig2dev/ci/639c36010a120e97a6e82e7cd57cbf9dbf4b64f1/

• Multiple vulnerabilities in fig2dev
• Ubuntu update for fig2dev
• SUSE update for transfig